An audit of the OpenSSL code by A.L. Digital Ltd and The Bunker, under the DARPA program CHATS, discovered a number of vulnerabilities in the OpenSSL code that are all potentially remotely exploitable.

From the OpenSSL advisory :

1. The client master key in SSL2 could be oversized and overrun a buffer. This vulnerability was also independently discovered by consultants at Neohapsis (http://www.neohapsis.com/) who have also demonstrated that the vulnerability is exploitable. Exploit code is NOT available at this time.

2. The session ID supplied to a client in SSL3 could be oversized and overrun a buffer.

3. The master key supplied to an SSL3 server could be oversized and overrun a stack-based buffer. This issues only affects OpenSSL 0.9.7 with Kerberos enabled.

4. Various buffers for ASCII representations of integers were too small on 64 bit platforms.

At the same time, various potential buffer overflows have had assertions added; these are not known to be exploitable.

Finally, a vulnerability was found by Adi Stav and James Yonan independently in the ASN1 parser which can be confused by supplying it with certain invalid encodings. There are no known exploits for this vulnerability.

All of these vulnerabilities are fixed in OpenSSL 0.9.6f. Patches have been applied to the versions of OpenSSL provided in this update to fix all of these problems, except for the ASN1 vulnerability, which a fix will be provided for once MandrakeSoft has had a chance to QA the new packages. In the meantime, it is is strongly encouraged that all users upgrade to these OpenSSL packages.

Update :

These new OpenSSL packages are available to additionally fix the ASN1 vulnerability described above. All Mandrake Linux users are encouraged to upgrade to these new packages.

The remote service seems to be using a version of OpenSSL that is older than 0.9.6e or 0.9.7-beta3.

Such versions are affected by a buffer overflow that may allow an attacker to execute arbitrary commands on the remote host with the privileges of the application itself.

Updated OpenSSL packages are available which fix several serious buffer overflow vulnerabilities.

OpenSSL is a commercial-grade, full-featured, and Open Source toolkit which implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. A security audit of the OpenSSL code sponsored by DARPA found several buffer overflows in OpenSSL which affect versions 0.9.7 and 0.9.6d and earlier :

1. The master key supplied by a client to an SSL version 2 server could be oversized, causing a stack-based buffer overflow. This issue is remotely exploitable. Services that have SSLv2 disabled would not be vulnerable to this issue. (CVE-2002-0656)

2. The SSLv3 session ID supplied to a client from a malicious server could be oversized and overrun a buffer. This issue looks to be remotely exploitable. (CVE-2002-0656)

3. Various buffers used for storing ASCII representations of integers were too small on 64 bit platforms. This issue may be exploitable.
(CVE-2002-0655)

A further issue was found in OpenSSL 0.9.7 that does not affect versions of OpenSSL shipped with Red Hat Linux (CVE-2002-0657).

A large number of applications within Red Hat Linux make use the OpenSSL library to provide SSL support. All users are therefore advised to upgrade to the errata OpenSSL packages, which contain patches to correct these vulnerabilities.

NOTE :

Please read the Solution section below as it contains instructions for making sure that all SSL-enabled processes are restarted after the update is applied.

Thanks go to the OpenSSL team and Ben Laurie for providing patches for these issues.

The remote host is running Oracle Application Server. It was not possible to determine its version, so the version of Oracle Application Server installed on the remote host could potentially be affected by multiple vulnerabilities :

  - CVE-2000-0169: Remote command execution in the web     listener component.

  - CVE-2000-1235: Information disclosure in the port     listener component and modplsql.

  - CVE-2000-1236: SQL injection in mod_sql.

  - CVE-2001-0326: Information disclosure in the Java     Virtual Machine.

  - CVE-2001-0419: Buffer overflow in ndwfn4.so.

  - CVE-2001-0591: Directory traversal.

  - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module.

  - CVE-2001-1217: Directory traversal vulnerability in the     PL/SQL Apache module.

  - CVE-2001-1371: Improper access control in the SOAP     service.

  - CVE-2001-1372: Information disclosure.

  - CVE-2002-0386: Denial of service through the     administration module for Oracle Web Cache.

  - CVE-2002-0559: Buffer overflows in the PL/SQL module.

  - CVE-2002-0560: Information disclosure in the PL/SQL     module.

  - CVE-2002-0561: Authentication bypass in the PL/SQL     Gateway web administration interface.

  - CVE-2002-0562: Information disclosure through     globals.jsa.

  - CVE-2002-0563: Improper access control on several     services.

  - CVE-2002-0564: Authentication bypass in the PL/SQL     module.

  - CVE-2002-0565: Information disclosure through JSP files     in the _pages directory.

  - CVE-2002-0566: Denial of service in the PL/SQL module.

  - CVE-2002-0568: Improper access control on XSQLConfig.xml     and soapConfig.xml.

  - CVE-2002-0569: Authentication bypass through     XSQLServlet.

  - CVE-2002-0655: Denial of service in OpenSSL.

  - CVE-2002-0656: Buffer overflows in OpenSSL.

  - CVE-2002-0659: Denial of service in OpenSSL.

  - CVE-2002-0840: Cross-site scripting in the default error     page of Apache.

  - CVE-2002-0842: Format string vulnerability in mod_dav.

  - CVE-2002-0843: Buffer overflows in ApacheBench.

  - CVE-2002-0947: Buffer overflow in rwcgi60.

  - CVE-2002-1089: Information disclosure in rwcgi60.

  - CVE-2002-1630: Improper access control on sendmail.jsp.

  - CVE-2002-1631: SQL injection in query.xsql.

  - CVE-2002-1632: Information disclosure through several     JSP pages.

  - CVE-2002-1635: Information disclosure in Apache.

  - CVE-2002-1636: Cross-site scripting in the htp PL/SQL     package.

  - CVE-2002-1637: Default credentials in multiple     components.

  - CVE-2002-1858: Information disclosure through the     WEB-INF directory.

  - CVE-2002-2153: Format string vulnerability in the     administrative pages of the PL/SQL module.

  - CVE-2002-2345: Credential leakage in the web cache     administrator interface.

  - CVE-2002-2347: Cross-site scripting in several JSP     pages.

  - CVE-2004-1362: Authentication bypass in the PL/SQL     module.

  - CVE-2004-1363: Buffer overflow in extproc.

  - CVE-2004-1364: Directory traversal in extproc.

  - CVE-2004-1365: Command execution in extproc.

  - CVE-2004-1366: Improper access control on     emoms.properties.

  - CVE-2004-1367: Credential leakage in Database Server.

  - CVE-2004-1368: Arbitrary file execution in ISQL*Plus.

  - CVE-2004-1369: Denial of service in TNS Listener.

  - CVE-2004-1370: Multiple SQL injection vulnerabilities in     PL/SQL.

  - CVE-2004-1371: Stack-based buffer overflow.

  - CVE-2004-1707: Privilege escalation in dbsnmp and nmo.

  - CVE-2004-1774: Buffer overflow in the MD2 package.

  - CVE-2004-1877: Phishing vulnerability in Single Sign-On     component.

  - CVE-2004-2134: Weak cryptography for passwords in the     toplink mapping workBench.

  - CVE-2004-2244: Denial of service in the XML parser.

  - CVE-2005-1383: Authentication bypass in HTTP Server.

  - CVE-2005-1495: Detection bypass.

  - CVE-2005-1496: Privilege escalation in the     DBMS_Scheduler.

  - CVE-2005-2093: Web cache poisoning.

  - CVE-2005-3204: Cross-site scripting.

  - CVE-2005-3445: Multiple unspecified vulnerabilities in     HTTP Server.

  - CVE-2005-3446: Unspecified vulnerability in Internet     Directory.

  - CVE-2005-3447: Unspecified vulnerability in Single     Sign-On.

  - CVE-2005-3448: Unspecified vulnerability in the OC4J     module.

  - CVE-2005-3449: Multiple unspecified vulnerabilities in     multiple components.

  - CVE-2005-3450: Unspecified vulnerability in HTTP Server.

  - CVE-2005-3451: Unspecified vulnerability in     SQL*ReportWriter.

  - CVE-2005-3452: Unspecified vulnerability in Web Cache.

  - CVE-2005-3453: Multiple unspecified vulnerabilities in     Web Cache.

  - CVE-2006-0273: Unspecified vulnerability in the Portal     component.

  - CVE-2006-0274: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2006-0275: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2006-0282: Unspecified vulnerability.

  - CVE-2006-0283: Unspecified vulnerability.

  - CVE-2006-0284: Multiple unspecified vulnerabilities.

  - CVE-2006-0285: Unspecified vulnerability in the Java Net     component.

  - CVE-2006-0286: Unspecified vulnerability in HTTP Server.

  - CVE-2006-0287: Unspecified vulnerability in HTTP Server.

  - CVE-2006-0288: Multiple unspecified vulnerabilities in     the Oracle Reports Developer component.

  - CVE-2006-0289: Multiple unspecified vulnerabilities.

  - CVE-2006-0290: Unspecified vulnerability in the Oracle     Workflow Cartridge component.

  - CVE-2006-0291: Multiple unspecified vulnerabilities in     the Oracle Workflow Cartridge component.

  - CVE-2006-0435: Unspecified vulnerability in Oracle     PL/SQL.

  - CVE-2006-0552: Unspecified vulnerability in the Net     Listener component.

  - CVE-2006-0586: Multiple SQL injection vulnerabilities.

  - CVE-2006-1884: Unspecified vulnerability in the Oracle     Thesaurus Management System component.

  - CVE-2006-3706: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3707: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3708: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3709: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3710: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3711: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3712: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3713: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3714: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5353: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5354: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5355: Unspecified vulnerability in Single     Sign-On.

  - CVE-2006-5356: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5357: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5358: Unspecified vulnerability in the Oracle     Forms component.

  - CVE-2006-5359: Multiple unspecified vulnerabilities in     Oracle Reports Developer component.

  - CVE-2006-5360: Unspecified vulnerability in Oracle Forms     component.

  - CVE-2006-5361: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5362: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5363: Unspecified vulnerability in Single     Sign-On.

  - CVE-2006-5364: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5365: Unspecified vulnerability in Oracle     Forms.

  - CVE-2006-5366: Multiple unspecified vulnerabilities.

  - CVE-2007-0222: Directory traversal vulnerability in     EmChartBean.

  - CVE-2007-0275: Cross-site scripting vulnerability in     Oracle Reports Web Cartridge (RWCGI60).

  - CVE-2007-0280: Buffer overflow in Oracle Notification     Service.

  - CVE-2007-0281: Multiple unspecified vulnerabilities in     HTTP Server.

  - CVE-2007-0282: Unspecified vulnerability in OPMN02.

  - CVE-2007-0283: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0284: Multiple unspecified vulnerabilities in     Oracle Containers for J2EE.

  - CVE-2007-0285: Unspecified vulnerability in Oracle     Reports Developer.

  - CVE-2007-0286: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0287: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0288: Unspecified vulnerability in Oracle     Internet Directory.

  - CVE-2007-0289: Multiple unspecified vulnerabilities in     Oracle Containers for J2EE.

  - CVE-2007-1359: Improper access control in mod_security.

  - CVE-2007-1609: Cross-site scripting vulnerability in     servlet/Spy in Dynamic Monitoring Services (DMS).

  - CVE-2007-2119: Cross-site scripting vulnerability in the     Administration Front End for Oracle Enterprise (Ultra)     Search.

  - CVE-2007-2120: Denial of service in the Oracle     Discoverer servlet.

  - CVE-2007-2121: Unspecified vulnerability in the COREid     Access component.

  - CVE-2007-2122: Unspecified vulnerability in the Wireless     component.

  - CVE-2007-2123: Unspecified vulnerability in the Portal     component.

  - CVE-2007-2124: Unspecified vulnerability in the Portal     component.

  - CVE-2007-2130: Unspecified vulnerability in Workflow     Cartridge.

  - CVE-2007-3553: Cross-site scripting vulnerability in     Rapid Install Web Server.

  - CVE-2007-3854: Multiple unspecified vulnerabilities in     the Advanced Queuing component and the Spatial     component.

  - CVE-2007-3859: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-3861: Unspecified vulnerability in Oracle     Jdeveloper.

  - CVE-2007-3862: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-3863: Unspecified vulnerability in Oracle     JDeveloper.

  - CVE-2007-5516: Unspecified vulnerability in the Oracle     Process Mgmt & Notification component.

  - CVE-2007-5517: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5518: Unspecified vulnerability in HTTP Server.

  - CVE-2007-5519: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5520: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-5521: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-5522: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5523: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-5524: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-5525: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-5526: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5531: Unspecified vulnerability in Oracle Help     for Web.

  - CVE-2008-0340: Multiple unspecified vulnerabilities in     the Advanced Queuing component and Spatial component.

  - CVE-2008-0343: Unspecified vulnerability in the Oracle     Spatial component.

  - CVE-2008-0344: Unspecified vulnerability in the Oracle     Spatial component.

  - CVE-2008-0345: Unspecified vulnerability in the Core     RDBMS component.

  - CVE-2008-0346: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2008-0347: Unspecified vulnerability in the Oracle     Ultra Search component.

  - CVE-2008-0348: Multiple unspecified vulnerabilities in     the PeopleTools component.

  - CVE-2008-0349: Unspecified vulnerability in the     PeopleTools component.

  - CVE-2008-1812: Unspecified vulnerability in the Oracle     Enterprise Manager component.

  - CVE-2008-1814: Unspecified vulnerability in the Oracle     Secure Enterprise Search or Ultrasearch component.

  - CVE-2008-1823: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2008-1824: Unspecified vulnerability in the Oracle     Dynamic Monitoring Service component.

  - CVE-2008-1825: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2583: Unspecified vulnerability in the sample     Discussion Forum Portlet for the Oracle Portal     component.

  - CVE-2008-2588: Unspecified vulnerability in the Oracle     JDeveloper component.

  - CVE-2008-2589: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2593: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2594: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2595: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2008-2609: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2612: Unspecified vulnerability in the Hyperion     BI Plus component.

  - CVE-2008-2614: Unspecified vulnerability in HTTP Server.

  - CVE-2008-2619: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2008-2623: Unspecified vulnerability in the Oracle     JDeveloper component.

  - CVE-2008-3975: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-3977: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-3986: Unspecified vulnerability in the Oracle     Discoverer Administrator component.

  - CVE-2008-3987: Unspecified vulnerability in the Oracle     Discoverer Desktop component.

  - CVE-2008-4014: Unspecified vulnerability in the Oracle     BPEL Process Manager component.

  - CVE-2008-4017: Unspecified vulnerability in the OC4J     component.

  - CVE-2008-5438: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-7233: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2009-0217: Signature spoofing vulnerability in     multiple components.

  - CVE-2009-0989: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-0990: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-0994: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-1008: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1009: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1010: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1011: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1017: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-1976: Unspecified vulnerability in HTTP Server.

  - CVE-2009-1990: Unspecified vulnerability in the Business     Intelligence Enterprise Edition component.

  - CVE-2009-1999: Unspecified vulnerability in the Business     Intelligence Enterprise Edition component.

  - CVE-2009-3407: Unspecified vulnerability in the Portal     component.

  - CVE-2009-3412: Unspecified vulnerability in the Unzip     component.

  - CVE-2010-0066: Unspecified vulnerability in the Access     Manager Identity Server component.

  - CVE-2010-0067: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2010-0070: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2011-0789: Unspecified vulnerability in HTTP Server.

  - CVE-2011-0795: Unspecified vulnerability in Single     Sign-On.

  - CVE-2011-0884: Unspecified vulnerability in the Oracle     BPEL Process Manager component.

  - CVE-2011-2237: Unspecified vulnerability in the Oracle     Web Services Manager component.

  - CVE-2011-2314: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2011-3523: Unspecified vulnerability in the Oracle     Web Services Manager component.

The version of OpenSSL installed on the remote host is prior to 0.9.6e. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.6e advisory.

  - The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to     cause a denial of service via invalid encodings. (CVE-2002-0659)

  - Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to     execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.
    (CVE-2002-0656)

  - OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of     integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly     execute arbitrary code. (CVE-2002-0655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The OpenSSL development team has announced that a security audit by A.L. Digital Ltd and The Bunker, under the DARPA CHATS program, has revealed remotely exploitable buffer overflow conditions in the OpenSSL code. Additionally, the ASN1 parser in OpenSSL has a potential DoS attack independently discovered by Adi Stav and James Yonan.

CAN-2002-0655 references overflows in buffers used to hold ASCII representations of integers on 64 bit platforms. CAN-2002-0656 references buffer overflows in the SSL2 server implementation (by sending an invalid key to the server) and the SSL3 client implementation (by sending a large session id to the client). The SSL2 issue was also noticed by Neohapsis, who have privately demonstrated exploit code for this issue. CAN-2002-0659 references the ASN1 parser DoS issue.

These vulnerabilities have been addressed for Debian 3.0 (woody) in openssl094_0.9.4-6.woody.2, openssl095_0.9.5a-6.woody.1 and openssl_0.9.6c-2.woody.1.

These vulnerabilities are also present in Debian 2.2 (potato). Fixed packages are available in openssl094_0.9.4-6.potato.2 and openssl_0.9.6c-0.potato.4.

A worm is actively exploiting this issue on internet-attached hosts;
we recommend you upgrade your OpenSSL as soon as possible. Note that you must restart any daemons using SSL. (E.g., ssh or ssl-enabled apache.) If you are uncertain which programs are using SSL you may choose to reboot to ensure that all running daemons are using the new libraries.

ID	Name	Product	Family	Published	Updated	Severity
13949	Mandrake Linux Security Advisory : openssl (MDKSA-2002:046-1)	Nessus	Mandriva Local Security Checks	7/31/2004	1/6/2021	high
11060	OpenSSL < 0.9.6e / 0.9.7b3 Multiple Remote Vulnerabilities	Nessus	Gain a shell remotely	8/5/2002	6/12/2020	critical
12315	RHEL 2.1 : openssl (RHSA-2002:157)	Nessus	Red Hat Local Security Checks	7/6/2004	1/14/2021	high
57619	Oracle Application Server Multiple Vulnerabilities	Nessus	Web Servers	1/24/2012	4/5/2019	critical
17746	OpenSSL 0.9.6 < 0.9.6e Multiple Vulnerabilities	Nessus	Web Servers	1/4/2012	10/23/2024	critical
14973	Debian DSA-136-1 : openssl - multiple remote exploits	Nessus	Debian Local Security Checks	9/29/2004	1/4/2021	high

Detections

Analytics

Plugins Search

high

critical

high

critical

critical

high